A computer system typically includes a number of hardware components including a processor to process information and data. The processor may operate in a normal mode and a protected mode such as the system management mode (SMM). SMM allows system developers and operators to provide functions such as power management or security, in a manner that is transparent to the operating system (OS) and other application programs. The processor may enter the SMM via a hardware interrupt referred to as a System Management Interrupt (SMI).
After receiving the SMI, the processor may store the current execution state referred to as the ‘context’ to a System Management Random Access Memory (SMRAM) before executing instructions, such as a SMI handler. While the processor is operating in SMM, an intruder may write malicious pieces of code to addresses associated with the SMI handler to initiate an attack to take over the processor and system.